A one-line package broke `npm create-react-app` • Hacker News Board

Re: A one-line package broke `npm create-react-app`

#61

Post by frank2 » Sat, Apr 25, 2020, 5:43 PM UTC

freeqaz wrote: post #27

redmorphium wrote: post #17

Earlier quoted context omitted.

Me neither. I can't wait for Deno 1.0 next month. https://deno.land/

What is this exactly? The website is a bit unclear.

Deno is much like node (uses the V8 engine, does not require a browser) and was created by the man who created node.

Re: A one-line package broke `npm create-react-app`

#62

Post by eropple » Sat, Apr 25, 2020, 5:45 PM UTC

jpangs88 wrote: post #57

freeqaz wrote: post #27

Earlier quoted context omitted.

What is this exactly? The website is a bit unclear.

I was wrong about what this was I have edited this comment

Why would a Rust wrapper around the C++ project that is V8, which implements a garbage-collected programming language and environment, "use less ram" just by virtue of some parts of it being written in Rust?

Re: A one-line package broke `npm create-react-app`

#63

Post by krapp » Sat, Apr 25, 2020, 5:45 PM UTC

jcelerier wrote: post #51

chvid wrote: post #7

And the source code of the library is: function isPromise(obj) { return !!obj && (typeof obj === 'object' || typeof obj === 'function') && typeof obj.then === 'function'; }

how does that make sense in any universe. Just because I have a function named "then" does not mean that my object is a promise. Maybe "then" is the name of a domain thing in my project, for instance a small DSL or something like that. arghhhhhh !

It's almost as if treating a dynamically typed interpreted language as if it had static types like C++ is fundamentally broken.

Re: A one-line package broke `npm create-react-app`

#64

Post by chrisoverzero » Sat, Apr 25, 2020, 5:46 PM UTC

2ion wrote: post #50

chvid wrote: post #7

And the source code of the library is: function isPromise(obj) { return !!obj && (typeof obj === 'object' || typeof obj === 'function') && typeof obj.then === 'function'; }

Wow just wow. So here's your new Promise object: class World { then () { return 0; } } isPromise(new World) // true If there really isn't a safe and better way to tell if an object is an instance of Promise…then color me impressed.

According this this library, maybe. According to the specification, no: https://promisesaplus.com/

Re: A one-line package broke `npm create-react-app`

#65

Post by tgv » Sat, Apr 25, 2020, 5:46 PM UTC

montroser wrote: post #43

Everyone crying about this on the Internet would do better to just take it as an easy lesson: pin your dependency versions for projects running in production. This was an honest oversight, and even somewhat inevitable with so many expected supported ways to import/export between cjs mjs amd umd etc. It will happen again. And when it happens the next time, if it ruins your life again, take issue with yourself for not…

> pin your dependency versions

And then to see "npm detected 97393 problems" or whatever the message exactly is.

Re: A one-line package broke `npm create-react-app`

#66

Post by ddevault » Sat, Apr 25, 2020, 5:46 PM UTC

zulgan wrote: post #42

Chill with the js hate, this happens everywhere. Maybe not to this extend, but if X (where X is whatever you are thinking about) had similar amount of people using it (especially junior people) this would happen there as well.

No, this does not happen everywhere. Show me this happening in Debian.

Re: A one-line package broke `npm create-react-app`

#67

Post by sneak » Sat, Apr 25, 2020, 5:46 PM UTC

I hope that more packaging systems take the go modules approach and cryptographically and immutably identify their dependencies at time of addition to the project. This sort of breakage shouldn’t be possible.

Re: A one-line package broke `npm create-react-app`

#68

Post by gombosg » Sat, Apr 25, 2020, 5:47 PM UTC

jakear wrote: post #39

0xff00ffee wrote: post #28

Earlier quoted context omitted.

Bumping your comment because I would like to know. I'm following the github thread.

Potentially. If cra had pinned all their deps, and used a bot to automatically bump deps contingent on passing a comprehensive regression matrix, this would have been avoided. GitHub's Dependabot is good for this. In my opinion everybody besides libraries should pin deps and use dependabot.

Exactly. We use Renovatebot for the same purpose. It pins dependencies and creates PRs for updates. Amazing to see how often the builds break, even sometimes after minor updates. But at least we fix them before release, and not after... :)

Re: A one-line package broke `npm create-react-app`

#69

Post by acdha » Sat, Apr 25, 2020, 5:47 PM UTC

tgv wrote: post #65

montroser wrote: post #43

Everyone crying about this on the Internet would do better to just take it as an easy lesson: pin your dependency versions for projects running in production. This was an honest oversight, and even somewhat inevitable with so many expected supported ways to import/export between cjs mjs amd umd etc. It will happen again. And when it happens the next time, if it ruins your life again, take issue with yourself for not…

> pin your dependency versions And then to see "npm detected 97393 problems" or whatever the message exactly is.

That’s good: it’s easy to update and it means you do it in a controlled manner rather than the next time something deploys.

Re: A one-line package broke `npm create-react-app`

#70

Post by salawat » Sat, Apr 25, 2020, 5:47 PM UTC

nemetroid wrote: post #20

0xff00ffee wrote: post #3

This is why regression suites are important. EDIT: I wasn't dissing the developers. They have regression, this was just an accident. I was stating it is important. My bad (too late to delete).

Could create-react-app have avoided this through regression suites?

The regression suite never gets to run if it shares the dependency.

And the system under test shouldn't even compile for the tests to run either. So it isn't so much the regression suite saving you so much as it is just acting as the client of first resort.